ID fraud prevention requires partnership, and according to Javelin, the future of fraud-detection should be built around integrating a bank's back-end solutions with the fraud-prevention and detection solutions in which consumers are already investing.
In the absence of the FFIEC's new guidance, industry experts say banks need to act now to help mitigate online risks associated with commercial accounts. "You can be sure the attacks won't abate until banks fight back," says Gartner's Avivah Litan.
Between March 2010 and April 2011, 20 incidents of wire fraud hit small and mid-sized U.S. businesses. All of the transactions involved payments routed to Chinese economic and trade companies located near the Russian border.
A U.S.-based hacker just pleaded guilty to stealing more than 675,000 credit cards that led to more than $36 million in fraud. "These SQL injections are allowing someone in through the side fence, not the front door," says information security attorney Randy Sabett.
"We took our understanding of the tools, tradecraft and techniques used by these malicious actors, and converted it into actionable information that ... would lower their risk to the type of attack we saw at RSA," DHS Secretary Janet Napolitano says.
Online security has come a long way in recent years, but so have phishing attacks. As the Epsilon e-mail breach proves, fraudsters are honing their attacks through the acquisition detailed e-mail profiles and sensitive information connections, says ID security expert Tim Rohrbaugh.
"The phishing only works if the consumer participates; they have to click on something; they have to open something," says Neal O'Farrell of the Identity Theft Council. "So, based on that assumption, shouldn't we be doing more to educate them?"
It's been over three months since the accidental disclosure. When will the final FFIEC authentication update be released? "I don't think we're any less safe," says Gartner's Avivah Litan. "We just need to step up enforcements."
Gigi Hyland, board member of the National Credit Union Administration, says the latest draft of authentication guidance is awaiting final signoff from just one member agency of the Federal Financial Institutions Examination Council.